[JBoss JIRA] Created: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
11:26 p.m.
SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jean-Frederic Clere
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:31 p.m.
New subject: [JBoss JIRA] Commented: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jim Tyrrell commented on MODCLUSTER-211:
----------------------------------------
https://bugzilla.redhat.com/show_bug.cgi?id=675019
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jean-Frederic Clere
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:52 a.m.
New subject: [JBoss JIRA] Assigned: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jean-Frederic Clere reassigned MODCLUSTER-211:
----------------------------------------------
Assignee: Joshua Wulf (was: Jean-Frederic Clere)
i remember you had the problem while we were preparing the docs in Neuchatel. Do you
remember the solution?
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Joshua Wulf
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:08 a.m.
New subject: [JBoss JIRA] Commented: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Joshua Wulf commented on MODCLUSTER-211:
----------------------------------------
Disable SELinux, which is not really a solution...
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Joshua Wulf
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:14 p.m.
New subject: [JBoss JIRA] Commented: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jim Tyrrell commented on MODCLUSTER-211:
----------------------------------------
Josh, we need to get this assigned to the engineering guys, and we might have one or two
changes to make to the docs.
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Joshua Wulf
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:06 p.m.
New subject: [JBoss JIRA] Commented: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jim Tyrrell commented on MODCLUSTER-211:
----------------------------------------
So I would like to change
manager.balancer.balancers
manager.sessionid.sessionid
manager.domain.domain
files to be created in /var/cache/httpd directory.
Instead of how they are being created today.
Josh this jira needs to get out of your hands.
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Joshua Wulf
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:56 p.m.
New subject: [JBoss JIRA] Assigned: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Joshua Wulf reassigned MODCLUSTER-211:
--------------------------------------
Assignee: Jean-Frederic Clere (was: Joshua Wulf)
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jean-Frederic Clere
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:57 p.m.
New subject: [JBoss JIRA] Assigned: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jean-Frederic Clere reassigned MODCLUSTER-211:
----------------------------------------------
Assignee: Jim Tyrrell (was: Jean-Frederic Clere)
I have no clue about SElinux you have to find someone else to help.
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:59 p.m.
New subject: [JBoss JIRA] Commented: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jim Tyrrell commented on MODCLUSTER-211:
----------------------------------------
Some engineering work is required per the note above, who is the core/main engineer on
this project?
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:54 p.m.
New subject: [JBoss JIRA] Commented: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jim Tyrrell commented on MODCLUSTER-211:
----------------------------------------
"System log files, such as messages and lastlog, go in the /var/log/
directory."
This should be no surprise because we've documented this since at least RHEL 3...
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/3/html/Referen...
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/4/html/Referen...
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/Deploym...
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Storage...
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:20 p.m.
New subject: [JBoss JIRA] Commented: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jean-Frederic Clere commented on MODCLUSTER-211:
------------------------------------------------
MemManagerFile (http://docs.jboss.org/mod_cluster/1.1.0/html/native.config.html#d0e556)
The default value is not what you expect :-(
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:34 p.m.
New subject: [JBoss JIRA] Commented: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jean-Frederic Clere commented on MODCLUSTER-211:
------------------------------------------------
Try MemManagerFile /var/cache/httpd
the manager.* files should be created in a place that SE linux allows.
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:38 p.m.
New subject: [JBoss JIRA] Commented: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jim Tyrrell commented on MODCLUSTER-211:
----------------------------------------
Where does that parameter get put?
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:54 p.m.
New subject: [JBoss JIRA] Commented: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jean-Frederic Clere commented on MODCLUSTER-211:
------------------------------------------------
In the virtualhost you use to receive messages from the nodes.
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:45 a.m.
New subject: [JBoss JIRA] Commented: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jean-Frederic Clere commented on MODCLUSTER-211:
------------------------------------------------
These two changes seem to allow this to work.
Change the port 8000 to 10001 and use the directive MemManagerFile /var/cache/httpd.
(from Jim)
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
10:04 a.m.
New subject: [JBoss JIRA] Commented: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Radoslav Husar commented on MODCLUSTER-211:
-------------------------------------------
Why does the port need to be changed?
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
5 a.m.
New subject: [JBoss JIRA] Commented: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jim Tyrrell commented on MODCLUSTER-211:
----------------------------------------
When SE Linux is enabled it gets in the way of random ports getting opened by application,
and will block that access it SE Linux is turned on. By default several ports are
"open" and port 10001 is one of those ports. Let me know if you have other
questions?
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:54 p.m.
New subject: [JBoss JIRA] Issue Comment Edited: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jean-Frederic Clere edited comment on MODCLUSTER-211 at 4/11/11 8:53 AM:
-------------------------------------------------------------------------
In the virtualhost you use to receive messages from the nodes.
Well it must going the main server...
was (Author: jfclere):
In the virtualhost you use to receive messages from the nodes.
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:08 a.m.
New subject: [JBoss JIRA] Commented: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Rebecca Newton commented on MODCLUSTER-211:
-------------------------------------------
Hi guys, can someone explain this to me in simple terms for the release notes, please?
Thanks.
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:29 p.m.
New subject: [JBoss JIRA] (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jean-Frederic Clere updated MODCLUSTER-211:
-------------------------------------------
Fix Version/s: 1.2.0.Beta5
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
Fix For: 1.2.0.Beta5
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:43 p.m.
New subject: [JBoss JIRA] (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jean-Frederic Clere updated MODCLUSTER-211:
-------------------------------------------
Fix Version/s: 1.2.1.Beta1
(was: 1.2.0.Final)
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
Fix For: 1.2.1.Beta1
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:02 p.m.
New subject: [JBoss JIRA] (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jean-Frederic Clere updated MODCLUSTER-211:
-------------------------------------------
Fix Version/s: 1.2.1.Beta2
(was: 1.2.1.Beta1)
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
Fix For: 1.2.1.Beta2
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:15 p.m.
New subject: [JBoss JIRA] (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
[
https://issues.jboss.org/browse/MODCLUSTER-211?page=com.atlassian.jira.pl...
]
Jean-Frederic Clere updated MODCLUSTER-211:
-------------------------------------------
Fix Version/s: 1.2.1.Beta3
(was: 1.2.1.Beta2)
SE Linux in RHEL 6 does not support mod_cluster in the context of
HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jim Tyrrell
Fix For: 1.2.1.Beta3
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux
policy. This should not need to be done as RHEL should ship the correctly enabled SE
Linux policy, although in talking with my resident RHEL expert, the error messaging is
that mod_cluster is using write instead of append as the existing policy does. I will
cross post this in BZ for the SE Linux team, as I am not sure where changes need to be
made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
4392
days inactive
4824
days old
mod_cluster-issues@lists.jboss.org
22 comments
5 participants
participants (5)
-
Jean-Frederic Clere (JIRA) -
Jim Tyrrell (JIRA)
-
Joshua Wulf (JIRA)
-
Radoslav Husar (JIRA)
-
Rebecca Newton (JIRA)